<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div dir="ltr">Thanks for the reply. You've convinced me to upgrade to 16.04, and I will be doing that when possible. Then I will work on these issues and take the suggestions you give.</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1492083297830_6262"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1492083297830_6200" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;" id="yui_3_16_0_ym19_1_1492083297830_6199"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1492083297830_6198"> <div dir="ltr" id="yui_3_16_0_ym19_1_1492083297830_6261"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1492083297830_6260"> <hr size="1" id="yui_3_16_0_ym19_1_1492083297830_6263"> <b><span style="font-weight:bold;">From:</span></b> Amos Jeffries <squid3@treenet.co.nz><br> <b><span style="font-weight: bold;">To:</span></b> squid-users@lists.squid-cache.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, April 10, 2017 9:52 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [squid-users] General security and usage questions<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1492083297830_6197"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1492083297830_6264">On 8/04/2017 1:01 a.m., j m wrote:<br clear="none">> I have a Ubuntu server set up that does various things in addition to<br clear="none">> being a web proxy (squid 3.3.8) to use remotely over the internet.<br clear="none">> This allows me to directly access internal devices with a web page on<br clear="none">> my LAN since my employer, like most, blocks VPN connections.<br clear="none"><br clear="none">Please upgrade to a current Ubuntu (Xenial or later) - that will give<br clear="none">you access to a much better version of Squid.<br clear="none"><br clear="none"><br clear="none">> My<br clear="none">> intention is to have the squid service running at all times, with a<br clear="none">> login, so I can use it any time. However, there's a few things I<br clear="none">> have not been able to answer/resolve through my own research:<br clear="none"><br clear="none">> 1. I am<br clear="none">> not able to SSH into my server from my employer. It's rare I'd need<br clear="none">> to do this, but ethical considerations aside, could this work with<br clear="none">> PuTTY over the squid proxy? I'm confused over how or if this would<br clear="none">> work using the Connection -> Proxy config in PuTTY. I can<br clear="none">> successfully use my proxy from a web browser, but have had no luck<br clear="none">> with SSH despite entering the proxy info into PuTTY. Supposedly the<br clear="none">> proxy needs to support the CONNECT method, but I'm unclear what this<br clear="none">> is or how to enable this. As an aside, I have experimented with<br clear="none">> shellinabox, but abandoned it when I learned it's not encrypted by<br clear="none">> default.<br clear="none"><br clear="none">PuTTY should be doable. You just have to configure it to use an HTTP proxy.<br clear="none"><br clear="none">Then you have to configure your squid.conf to allow those requests. You<br clear="none">do that by:<br clear="none"><br clear="none"> 1) adding port 22 to the SSL_Ports and Safe_ports ACLs.<br clear="none"><br clear="none"> 2) adding extra custom rules to permit CONNECT to port 22 from the<br clear="none">IP(s) your PuTTY connections will be coming from.<br clear="none"><br clear="none"> 3) explicitly deny all other port 22 connections since the default<br clear="none">securuty lines no longer do that for you.<br clear="none"><br clear="none">PuTTY should now be able to go through the proxy to wherever, the rest<br clear="none">is up to the server permissions at the destination.<br clear="none"><br clear="none">I highly recommend that you use client cert verification and good cert<br clear="none">crypto rather than user:pass login - the login method would be visible<br clear="none">across the whole Internet to (and from) the proxy.<br clear="none"><br clear="none"><br clear="none">> <br clear="none">> 2. How good is squid's security as far as leaving its port open to<br clear="none">> the Internet, which I obviously have to do in my case?<br clear="none"><br clear="none">Depends on what you are meaning by "security".<br clear="none"><br clear="none">Squid can be used as a relay to reach anywhere your http_access rules<br clear="none">permit. That is why the very first things we do is close off ports<br clear="none">0-1024 tight as possible.<br clear="none"><br clear="none">So treat it as being an open hole in your network firewall to *any*<br clear="none">machines port 22.<br clear="none"><br clear="none"><br clear="none"><br clear="none">> I found it<br clear="none">> interesting that if I enter <a shape="rect" href="http://myip:myport/" target="_blank">http://myip:myport </a>from over the<br clear="none">> Internet, it responds with a "The requested URL could not be<br clear="none">> retrieved" page, along with information that identifies it as squid,<br clear="none">> along with the version number and server name, without asking for a<br clear="none">> login. Being unfamiliar with web proxies, this might be the norm for<br clear="none">> all I know. If I set up a browser to use it as a proxy, it does ask<br clear="none">> for a login. It appears the error pages are in<br clear="none">> /usr/share/squid/errors, but is there a way for it to be more<br clear="none">> discrete, preferably to not respond at all or ask for a login? Below<br clear="none">> is my squid.conf. I removed all the commented lines, and pieced one<br clear="none">> together from information online. My goal is to have it proxy<br clear="none">> basically anything thrown at it if authenticated,<br clear="none"><br clear="none">That is not possible. As my most frequent comment says "Squid is an HTTP<br clear="none">proxy".<br clear="none"><br clear="none">Meaning it only proxies/relays the protocols it understands - primary<br clear="none">HTTP, nowdays also FTP. Nothing else.<br clear="none"><br clear="none">Any other protocol must use an HTTP CONNECT request to get through<br clear="none">reliably, and that depend on the sending software being aware of the<br clear="none">proxy being an HTTP one. Which is why the default behaviour is to<br clear="none">respond with an HTTP error page - so smart senders can use that info to<br clear="none">switch to HTTP.<br clear="none"><br clear="none"><br clear="none">> be as secure as<br clear="none">> reasonably possible,<br clear="none"><br clear="none">FYI: Proxying anything and being secure are opposites. You only get to<br clear="none">pick one.<div class="yqt3506579559" id="yqtfd07828"><br clear="none"><br clear="none"><br clear="none">> absolutely no caching, and enable SSH<br clear="none">> connections through it, if possible. Thanks in advance. auth_param<br clear="none">> basic program /usr/lib/squid3/basic_ncsa_auth<br clear="none">> /etc/squid3/passwordsauth_param basic realm proxyacl authenticated<br clear="none">> proxy_auth REQUIREDhttp_access allow authenticated # Choose the port<br clear="none">> you want. Below we set it to default 3128.http_port 8092cache deny<br clear="none">> allaccess_log none acl CONNECT method CONNECT</div><br clear="none">> <br clear="none"><br clear="none">Please use at minimum the config file lines shown here for your current<br clear="none">Squid version:<br clear="none"> <<a shape="rect" href="http://wiki.squid-cache.org/Squid-3.3" target="_blank">http://wiki.squid-cache.org/Squid-3.3</a>><br clear="none">(or if you upgrade the relevant wiki page for that series)<br clear="none"><br clear="none">Your own customisations should be added to those, not replacing.<br clear="none"><br clear="none">NP: while debugging this new configuration it is a good idea to<br clear="none">re-enable the access.log outputs so you can see what is actually going<br clear="none">on. There is no way to decide if something is actually correct if you<br clear="none">cannot see it happening.<br clear="none"><br clear="none">Amos<br clear="none">_______________________________________________<br clear="none">squid-users mailing list<br clear="none"><a shape="rect" ymailto="mailto:squid-users@lists.squid-cache.org" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br clear="none"><a shape="rect" href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><div class="yqt3506579559" id="yqtfd38412"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>